Red Hat Security Advisory: rh-ruby30-ruby security update

Fixed packages 22

Vulnerabilities 4

• High 8.8
  CVE-2020-36327

  Dependency Confusion in Bundler

  Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a …

  rubygems bundler bundler Debian Ubuntu RubyGems
  Apr 29, 2021
• High 7.0
  CVE-2021-31799

  Arbitrary Code Execution in Rdoc

  In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  Jul 29, 2021
• Unscored —
  CVE-2021-31810

  An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can u…

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine
  Jul 13, 2021
• Unscored —
  CVE-2021-32066

  An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an …

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine
  Aug 1, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1958999
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980126
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980128
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980132
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3982.json
• report
  https://access.redhat.com/security/cve/CVE-2020-36327
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36327
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36327
• article
  https://access.redhat.com/articles/6206172
• article
  https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/
• report
  https://access.redhat.com/security/cve/CVE-2021-31799
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-31799
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-31799
• article
  https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/
• report
  https://access.redhat.com/security/cve/CVE-2021-31810
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-31810
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-31810
• article
  https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/
• report
  https://access.redhat.com/security/cve/CVE-2021-32066
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-32066
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-32066
• article
  https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/